MASKED DIGITAL SIGNATURES 



This invention relates to a method of accelerating digital signature operations used in 
secure communication systems, and in particular for use with processors having limited 
computing power. 

BACKGROUND OF THE INVENTION 

One of the functions performed by a cryptosystem is the computation of digital 
signatures that are used to confirm that a particular party has originated a message and that 
the contents have not been altered during transmission. A widely used set of signature 
protocols utilizes the ElGamal public key signature scheme that signs a message with the 
sender's private key. The recipient may then recover the message with the sender's public 
key. The ElGamal scheme gets its security from calculating discrete logarithms in a finite 
field. Furthermore, the ElGamal-type signatures work in any group and in particular elliptic 
curve groups. For example given the elliptic curve group E(F q ) then for P e E(F q ) and Q = 
aP the discrete logarithm problem reduces to finding the integer a. Thus these cryptosystems 
can be computationally intensive. 

Various protocols exist for implementing such a scheme. For example, a digital 
signature algorithm DSA is a variant of the ElGamal scheme. In these schemes a pair of 
correspondent entities A and B each create a public key and a corresponding private key. 
The entity A signs a message m of arbitrary length. The entity B can verify this signature by 
using A's public key. In each case however, both the sender, entity A, and the recipient, 
entity B, are required to perform a computationally intensive operations to generate and 
verify the signature respectively. Where either party has adequate computing power this does 
not present a particular problem but where one or both the parties have limited computing 
power, such as in a 'smart card 1 application, the computations may introduce delays in the 
signature and verification process. 

Public key schemes may be implemented using one of a number of multiplicative 
groups in which the discrete log problem appears intractable but a particularly robust 
implementation is that utilizing the characteristics of points on an elliptic curve over a finite 



field. This implementation has the advantage that the requisite security can be obtained with 
relatively small orders of field compared with, for example, implementations in Z p * and 
therefore reduces the bandwidth required for communicating the signatures. 

In a typical implementation of such a digital signature algorithm such as the Elliptic 
Curve Digital Signature Algorithm (ECDSA) a signature component s has the form: 

s = fc^ (e + dr) mod n 

where: 

d is a long term private key random integer of the signor; 

Q is a public key of the signor derived by computing the point Q = dP\ 

P is a point (x, y) on the curve which is a predefined parameter of the system; 

k is a random integer selected as a short term private or session key, and has a 

corresponding short term public key R = fcP; 

e is a secure hash, such as the SHA-1 hash function of a message; and 

n is the order of the curve. 

In this scheme the signor represents the x coordinate of the point it? as an integer z 
and then calculates a first signature component r = z mod n. Next, the second signature 
component s above is calculated. The signature components s and r and a message Mis then 
transmitted to the recipient. In order for the recipient to verify the signature (r,s) on M, the 
recipient looks up the public key Q of the signor. A hash e' of the message M is calculated 
using a hash function H such that e ' = H(M) t A value c = W mod n is also calculated. Next, 
integer values u\ and U2 are calculated such that uj^e'c mod n and U2= rc mod n. In order 
that the signature be verified, the value ujP + 112Q must be calculated. Since P is known and 
is a system wide parameter, the value u jP may be computed quickly. The point R = ujP + 
U2Q is computed. The field element x of the point R = (x j,y) is converted to an integer z, and 
a value v = z mod n is computed. If v = r, then the signature is valid. 

Other protocols, such as the MQV protocols also require similar computations when 
implemented over elliptic curves which may result in slow signature and verification when 
the computing power is limited. The complexity of the calculations may be explained by 
observing a form of the elliptic curve. Generally, the underlying elliptic curve has the form 



y 2 + xy = x 3 + ax + b and the addition of two points having coordinates (x, y, ) and (x 2) y 2 ) 
results in a point (x 3 ,y 3 ) where :- 
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The doubling of a point i.e. P to 2P, is performed by adding the point to itself so that 
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It may be seen in the above example of the ECDSA algorithm that the calculation of 
the second signature component involves at least the computation of an inverse. Modulo a 
number the generation of each of the doubled points requires the computation of both the x 

15 and y coordinates and the latter requires a further inversion. These steps are computationally 
complex and therefore require either significant time or computing power to perform. 
Inversion is computationally intensive, and generally performed within a secure boundary 
where computational power is limited thus it would be advantageous to perform such 
calculations outside the secure boundary, particularly where computational power is more 

20 readily available. This however cannot be done directly on the ECDSA signature scheme 
without potentially compromising the private key information. Therefore there exists a need 
for a method of performing at least part of a signature operation outside a secure boundary 
while still maintaining an existing level of security in current signature schemes. 
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SUMMARY OF THE INVENTION 

It is therefore an object of the present invention to provide a method and apparatus in 
which at least some of the above disadvantages are mitigated. 

This invention seeks to provide a digital signature method, which may be 
implemented relatively efficiently on a processor with limited processing capability, such as 
a 'smart card* or the like. 

In general terms, the present invention provides a method and apparatus in which 
signature verification may be accelerated. 

In accordance with this invention there is provided; a method of signing and 
authenticating a message m in a public key data communication system, comprising the steps 
of: 

in a secure computer system: 

(a) generating a first short term private key 

(b) computing a first short term public key derived from the first short term 
private key k, 

(c) computing a first signature component r by using the first short term public 

key lq 

(d) generating a second short term private key t\ 

(e) computing a second signature component s by using the second short term 
private key / on the message m, the long term private key and the first signature 
component r\ 

(f) computing a third signature component c using the first and second short term 
private keys / and k respectively, and sending the signature components (r, s, c) as a 
masked digital signature of the message m to a receiver computer system; in the 
receiver system; 

(g) using said second and third signature components (s,c) computing a normal 

signature component s and sending the signature components (s , r) as a normal 
digital signature to a verifer computer system; and 

(h) verifying normal signature. 



In accordance with a further aspect of the invention there is provided; a processing 
means for assigning a message m without performing inversion operations and including a 
long term private key contained within a secure boundary and a long term public key derived 
from the private key and a generator of predetermined order in a field, the processing means 
5 comprising: 

within the secure boundary; 

means for generating a first short term private key; 

means for generating a second short term private key; 

means for generating a first signature, component using at least the second short term 
10 session key; and 

generating a masked signature component using the first and second short term 
session keys to produce masked signature components of the message m. 

BRIEF DESCRIPTION OF THE DRAWINGS 
15 Embodiments of the present invention will now be described by way of example only 

with reference to the accompanying drawings in which:- 
Figure 1 is a schematic representation of a communication system; and 
Figure 2 is a flow chart showing a signature algorithm according to the present invention. 

20 DETAILED DESCRIPTION OF A PREFERRED EMBODIMENT 

Referring therefore to Figure 1, a data communication system 10 includes a pair of 
correspondents, designated as a sender 12, and a recipient 14, who are connected by a 
communication channel 16. Each of the correspondents 12,14 includes an encryption unit 
18,20 respectively that may process digital information and prepare it for transmission 

25 through the channel 16 as will be described below. The sender is the party signing a message 
m to be verified by the recipient. The signature is generally performed in the encryption unit 
18 and normally defines a secure boundary. The sender could be a 'smart card 1 , a terminal or 
similar device. If for example the signor is a 'smart card', it generally has limited processing 
power. However, the 'smart card 1 is typically used in conjunction with a terminal 22 which 

30 has at least some computing power. The 'smart card' is inserted into a terminal 22 which 
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then forwards digital information received from the 'smart card' 12 along the channel 16 to 
the recipient 14. The terminal may preprocess this information before sending it along the 
channel 16. 

In accordance then with a general embodiment, the sender assembles a data string, 
5 which includes amongst others the public key Q of the sender, a message m, the sender' s 
short-term public key R and a signature S of the sender. When assembled the data string is 
sent over the channel 16 to the intended recipient 18. The signature S is generally comprised 
of one or more components as will be described below with reference to a specific 
embodiment and according to a signature scheme being implemented by the data 
10 communication system. 

The invention describes in a broad aspect a signature algorithm in which the private 
key is masked to generate masked signature components which may then be converted to a 
regular signature prior to the verification of the signature. 

Referring to figure 2, it is assumed that £ is an elliptic curve defined over Fq, P is 
15 point of prime order n in E(Fg), dis the senders private signature key, such that 2<d< n-2, 
Q=dP is the senders public verification key and m is the message to be signed. It is further 
assumed these parameters are stored in memory within a secure boundary as indicated by 
block 30. For example if the sender is a 'smart card', then that would define the secure 
boundary while for example the terminal in which the 'smart card' was inserted would be 
20 outside the secure boundary. The first step is for the sender to sign the message m. The 

sender computes a hash value e = H(m) of the message m, where H\s typically a SHA-1 hash 
function. A first statistically unique and unpredictable integer k, the first short term private 
key, is selected such that 2 <k < (n-2). Next a point (x„y,) = kP is computed. The field 
element x, of the point kP is converted to an integer x, and a first signature component r = 
25 (mod n) is calculated. A second statistically unique and unpredictable integer the second 
short-term private key is selected such that 2 < t < (n-2). Second and third signature 
components s = t(e+dr)(mod n) and c = tk (mod n) respectively are also computed as 
indicated. This generates the masked ECDSA signature having components (r,s,c). This 
masked ECDSA signature (r, s, c) may be converted to regular ECDSA signature {s , r) by 
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computing s = c~ l smodn. The ECDSA signature of the sender 12 is then s andr. The 

signature ( s , r) can then be verified as a normal ECDSA signature as described below. Thus 
the sender can either forward the masked ECDSA signature (s,r,c) to the verifier where the 

verifier can do the conversion operation to obtain the signature (s , r) prior to the verification 
5 operation or the sender can perform the conversion outside the secure boundary, as for 

example in a terminal and then forward the DS A signature ( s , r) to the verifier. 

Once the recipient has the signature components (s , r), then to verify the signature 
the recipient calculates a hash value e - H(m) where this the hash function of the signor and 

known to the verifier of the message m and then computes u = s l emodn and 

10 v = s V modn . Thus the point (x„y,) = uP + vQ may now be calculated. If {x u y x ) is the 
point at infinity then the signature is rejected. If not however the field element x x is 

converted to an integer . Finally the valuer' = x x mod a is calculated. If r ! = r the signature 
is verified. If r' * r then the signature is rejected. 

Thus it may be seen that an advantage of the masked ECDSA is that modular inverse 

15 operation of the normal ECDSA is avoided for the masked signing operation. As stated 
earlier this is very useful for some applications with limited computational power. The 
masked signature to ECDSA signature conversion operation can be performed outside the 
secure boundary protecting the private key of the sender. For example if the sender was a 
'smart card 1 that communicated with a card reader then this operation could be performed in 

20 the 'smart card 1 reader. Alternatively the masked signature can be transmitted to the verifier, 
and the verifier can do the conversion operation prior to the verification operation. It may be 
noted that in the masked ECDSA, no matter how we choose /, we always have t = c1cK 
Since c is made public, t is not an independent variable. 

While the invention has been described in connection with specific embodiments 

25 thereof and in specific uses, various modifications thereof will occur to those skilled in the art 
without departing from the spirit of the invention as set forth in the appended claims. For 
example in the above description of preferred embodiments, use is made of multiplicative 
notation, however the method of the subject invention may be equally well described 
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utilizing additive notation. It is well known for example that elliptic curve algorithm 
embodied in the ECDSA is equivalent of the DSA and that the elliptic curve analog of a 
discrete log logorithm algorithm that is usually described in a setting of, F* the 
multiplicative group of the integers modulo a prime. There is a correspondence between the 
5 elements and operations of the group F* and the elliptic curve group E(Fq). Furthermore, 
this signature technique is equally well applicable to functions performed in a field defined 
over Fp and F r . It is also to be noted that the DSA signature scheme described above is a 

specific instance of the ElGamal generalized signature scheme which is known in the art and 
thus the present techniques are applicable thereto. 
10 The present invention is thus generally concerned with an encryption method and 

system and particularly an elliptic curve encryption method and system in which finite field 
elements are multiplied in a processor efficient manner. The encryption system can comprise 
any suitable processor unit such as a suitably programmed general-purpose computer. 
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